Web Search Plus

This skill appears to do what it claims, but review a few practical points before installing: - Cache: Search queries and provider results are stored in .cache/ by default (or WSP_CACHE_DIR). If you handle sensitive queries, either disable caching per-run, change the cache directory to a controlled location, or clear/secure the cache regularly. - .env autoload: The script will auto-load a .env file from the skill root if present. Do not keep secrets in that file unless you intend the skill (or other local users) to access them. Prefer process-level environment variables or dedicated API accounts/limits. - SearXNG usage: The skill can call a self-hosted SearXNG instance. Only point SEARXNG_INSTANCE_URL to instances you control or trust; avoid public instances that may log queries. The changelog mentions previous SSRF issues that were fixed — if you are running an older fork, verify the version includes the SSRF protections. - Provider keys: Grant minimal-privilege / cost-limited provider API keys where possible. Using a single dedicated key/account for testing is safer than reusing high-privilege keys. - Updates & provenance: The registry entry has no homepage and an unknown source. If you plan to rely on this in production, prefer obtaining the code from an authoritative repository (or verify the publisher) and keep it updated. If you need stronger assurance, audit the full search.py and setup.py files locally for any network calls beyond advertised provider endpoints.